PatchTheCVEracoon vulnerabilities and fixes
Recent CVEs affecting racoon, with upgrade or downgrade steps. 6 tracked.
racoon has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2005-03-14. Highest priority: CVE-2004-0607 (score 63/100).
- CVE-2005-0398 MEDIUM 5.0 DOWNGRADE DOWNGRADE The KAME racoon daemon in ipsec-tools before 0.5 allows remote attackers to cause a denial of service (crash)
- CVE-2004-0607 HIGH 10.0 DOWNGRADE DOWNGRADE The eay_check_x509cert function in KAME Racoon successfully verifies certificates even when OpenSSL validation
- CVE-2004-0403 MEDIUM 5.0 UPGRADE Racoon before 20040408a allows remote attackers to cause a denial of service (memory consumption) via an ISAKM
- CVE-2004-0392 MEDIUM 5.0 UPGRADE racoon before 20040407b allows remote attackers to cause a denial of service (infinite loop and dropped connec
- CVE-2004-0164 MEDIUM 5.0 DOWNGRADE KAME IKE daemon (racoon) does not properly handle hash values, which allows remote attackers to delete certifi
- CVE-2004-0155 HIGH 7.5 MITIGATE The KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but doe
FAQ
How do I fix racoon vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is racoon being exploited right now?
None of the tracked racoon CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which racoon CVE should I patch first?
CVE-2004-0607 currently ranks highest (63/100): The eay_check_x509cert function in KAME Racoon successfully verifies certificates even when OpenSSL validation.